core.go

package main

import (
	"embed"
	"fmt"
	"os"
	"strconv"
	"strings"
	"time"

	bash "github.com/tkdeng/gobash"
	"github.com/tkdeng/goutil"
	"github.com/tkdeng/regex"
)

//go:embed all:assets/fs/*
var assetFS embed.FS

type coreInstaller struct {
	progressBar *bash.ProgressBar
	opts        *config
}

func installConfig(opts *config) {
	if PM == "dnf" {
		if opts.addBool("ufw", "Install UFW (Uncomplicated Firewall)?", true) {
			fmt.Println("Using UFW...")
		} else {
			fmt.Println("Using Firewalld...")
		}
	} else {
		opts.setBool("ufw", true)
	}

	if opts.addBool("cloudflareDNS", "Use Cloudflare DNS?", true) {
		fmt.Println("Using Cloudflare DNS...")
		if opts.addBool("googleFallbackDNS", "Use Google DNS as fallback?", true) {
			fmt.Println("Using Google Fallback DNS...")
		} else {
			fmt.Println("Using Cloudflare Fallback DNS...")
		}
	} else {
		fmt.Println("Using Google DNS...")
	}

	if !SSHClient {
		opts.addBool("disableSSH", "Disable SSH?", true)
	} else {
		opts.setBool("disableSSH", false)
	}

	fmt.Println("")
	time.Sleep(1 * time.Second)
}

func installCore(opts *config) {
	progressBar := bash.NewProgressBar("Installing")
	defer progressBar.Stop()

	core := &coreInstaller{progressBar: progressBar, opts: opts}

	progressBar.SetSize(19)

	core.countFiles("")

	if PM == "dnf" {
		progressBar.AddSize(8)
	} else if PM == "apt" {
		progressBar.AddSize(4)
		if !hasNalaPM {
			progressBar.AddSize(1)
		}
	}

	if opts.bool("ufw") {
		progressBar.AddSize(1)
	}

	if opts.bool("disableSSH") {
		progressBar.AddSize(1)
	}

	fmt.Println("Installing Special Modifications...")

	//* install files
	progressBar.Msg("Installing Files")
	core.files()
	progressBar.Step()

	//* update
	progressBar.Msg("Updating")
	update(true)
	progressBar.Step()

	//* install ufw
	if core.opts.bool("ufw") {
		core.progressBar.Msg("Installing UFW")
		installPKG("ufw")
		bash.Run([]string{`systemctl`, `enable`, `--now`, `ufw`}, "", nil, true)

		if !SSHClient {
			bash.RunRaw(`for i in $(ufw status | wc -l); do ufw --force delete 1; done`, "", nil)
		}

		bash.Run([]string{`ufw`, `default`, `deny`, `incoming`}, "", nil, true)
		bash.Run([]string{`ufw`, `default`, `allow`, `outgoing`}, "", nil, true)
		bash.Run([]string{`ufw`, `enable`}, "", nil, true)

		bash.Run([]string{`systemctl`, `disable`, `--now`, `firewalld`}, "", nil, true)
		core.progressBar.Step()
	}

	//* secure dns
	core.progressBar.Msg("Securing DNS")

	// fix moved systemd/resolved.conf file
	if _, err := os.Stat("/etc/systemd/resolved.conf"); err != nil {
		if _, err := os.Stat("/usr/lib/systemd/resolved.conf"); err == nil {
			bash.Run([]string{`ln`, `-s`, `/usr/lib/systemd/resolved.conf`, `/etc/systemd/resolved.conf`}, "", nil, true)
		}
	}

	if file, err := os.Open("/etc/systemd/resolved.conf"); err == nil {
		regex.Comp(`(?m)^#?DNSSEC=.*$`).RepFile(file, []byte(`DNSSEC=yes`), false)
		regex.Comp(`(?m)^#?DNSOverTLS=.*$`).RepFile(file, []byte(`DNSOverTLS=yes`), false)
		regex.Comp(`(?m)^#?Cache=.*$`).RepFile(file, []byte(`Cache=yes`), false)

		if core.opts.bool("cloudflareDNS") {
			regex.Comp(`(?m)^#?DNS=.*$`).RepFile(file, []byte(`DNS=1.1.1.2#security.cloudflare-dns.com 2606:4700:4700::1112#security.cloudflare-dns.com`), false)

			if core.opts.bool("googleFallbackDNS") {
				regex.Comp(`(?m)^#?FallbackDNS=.*$`).RepFile(file, []byte(`FallbackDNS=8.8.4.4#dns.google 2001:4860:4860::8844#dns.google`), false)
			} else {
				regex.Comp(`(?m)^#?FallbackDNS=.*$`).RepFile(file, []byte(`FallbackDNS=1.0.0.2#security.cloudflare-dns.com`), false)
			}

			regex.Comp(`(?m)^#?Domains=.*$`).RepFile(file, []byte(`Domains=security.cloudflare-dns.com?ip=1.1.1.2&name=Cloudflare&blockedif=zeroip dns.google`), false)
		} else {
			regex.Comp(`(?m)^#?DNS=.*$`).RepFile(file, []byte(`DNS=8.8.8.8#dns.google 2001:4860:4860::8888#dns.google`), false)
			regex.Comp(`(?m)^#?FallbackDNS=.*$`).RepFile(file, []byte(`FallbackDNS=8.8.4.4#dns.google 2001:4860:4860::8844#dns.google`), false)
			regex.Comp(`(?m)^#?Domains=.*$`).RepFile(file, []byte(`Domains=dns.google`), false)
		}

		file.Sync()
		file.Close()
	}

	bash.Run([]string{`systemctl`, `restart`, `systemd-resolved`}, "", nil, true)
	bash.Run([]string{`resolvectl`, `flush-caches`}, "", nil, true)
	core.progressBar.Step()

	core.progressBar.Msg("Testing DNS")
	bash.RunRaw(`if [ "$(timeout 10 ping -c1 google.com 2>/dev/null)" = "" ]; then sed -r -i 's/^DNSSEC=.*$/DNSSEC=allow-downgrade/m' /etc/systemd/resolved.conf; systemctl restart systemd-resolved; resolvectl flush-caches; fi`, "", nil, true)
	core.progressBar.Step()

	bash.RunRaw(`if [ "$(timeout 10 ping -c1 google.com 2>/dev/null)" = "" ]; then sed -r -i 's/^DNSSEC=/#DNSSEC=/m' /etc/systemd/resolved.conf; systemctl restart systemd-resolved; resolvectl flush-caches; fi`, "", nil, true)
	core.progressBar.Step()

	//* disable ssh for desktop
	if !SSHClient && opts.bool("disableSSH") {
		bash.Run([]string{`systemctl`, `disable`, `sshd`, `--now`}, "", nil, true)
		bash.RunRaw(`if test -f "/etc/ssh/sshd_config"; then sed -r -i 's/^PermitRootLogin (.*)$/PermitRootLogin no/m' "/etc/ssh/sshd_config"; sed -r -i 's/^PasswordAuthentication (.*)$/PasswordAuthentication no/m' "/etc/ssh/sshd_config"; fi`, "", nil, true)

		//* set password quality rules
		bash.RunRaw(`if test -f "/etc/security/pwquality.conf"; then sed -r -i 's/^# difoc = (.*)$/  difoc = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# minlen = (.*)$/  minlen = 4/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# dcredit = (.*)$/  dcredit = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# ucredit = (.*)$/  ucredit = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# lcredit = (.*)$/  lcredit = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# ocredit = (.*)$/  ocredit = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# minclass = (.*)$/  minclass = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# maxrepeat = (.*)$/  maxrepeat = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# gecoscheck = (.*)$/  gecoscheck = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# dictcheck = (.*)$/  dictcheck = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# usercheck = (.*)$/  usercheck = 1/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# usersubstr = (.*)$/  usersubstr = 0/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# enforcing = (.*)$/  enforcing = 1/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# retry = (.*)$/  retry = 3/m' "/etc/security/pwquality.conf"; sed -r -i 's/^# local_users_only$/  local_users_only/m' "/etc/security/pwquality.conf"; fi`, "", nil, true)

		core.progressBar.Step()
	}

	//* install nala
	if PM == "apt" && !hasNalaPM {
		core.progressBar.Msg("Installing Nala")
		installPKG("nala")
		bash.Run([]string{`apt`, `-y`, `update`}, "", nil, true)
		if out, err := bash.Run([]string{`which`, `nala`}, "", nil, true); err == nil && len(out) != 0 {
			bash.Run([]string{`nala`, `update`}, "", nil, true)
			hasNalaPM = true
		}
		core.progressBar.Step()
	}

	if PM == "dnf" {
		//* install rpm repos
		core.progressBar.Msg("Installing RPM repos")
		bash.RunRaw(`dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm`, "", nil, true)
		bash.RunRaw(`dnf -y install https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm`, "", nil, true)
		installPKG(`fedora-workstation-repositories`)
		bash.Run([]string{`fedora-third-party`, `enable`}, "", nil, true)
		bash.Run([]string{`fedora-third-party`, `refresh`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `groupupdate`, `core`}, "", nil, true)
		core.progressBar.Step()

		bash.Run([]string{`dnf`, `clean`, `all`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `autoremove`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `distro-sync`}, "", nil, true)
		core.progressBar.Step()

		//* install flatpak
		core.progressBar.Msg("Installing flatpak")
		installPKG(`flatpak`)
		bash.Run([]string{`flatpak`, `remote-add`, `--if-not-exists`, `flathub`, `https://flathub.org/repo/flathub.flatpakrepo`}, "", nil, true)
		// bash.Run([]string{`flatpak`, `update`, `-y`, `--noninteractive`}, "", nil, true)
		bash.Run([]string{`flatpak`, `install`, `-y`, `flathub`, `com.github.tchx84.Flatseal`}, "", nil, true)
		core.progressBar.Step()

		//* install snap
		core.progressBar.Msg("Installing snap")
		installPKG(`snap`)
		bash.Run([]string{`ln`, `-s`, `/var/lib/snapd/snap /snap`}, "", nil, true)
		bash.Run([]string{`systemctl`, `enable`, `snapd`, `--now`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`}, "", nil, true) // fix: not seeded yet will trigger and fix itself for the next command
		bash.Run([]string{`snap`, `install`, `core`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`, `core`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`}, "", nil, true)
		core.progressBar.Step()

		bash.Run([]string{`dnf`, `clean`, `all`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `autoremove`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `distro-sync`}, "", nil, true)
		core.progressBar.Step()

		//* install multimedia
		core.progressBar.Msg("Updating multimedia codecs")
		bash.Run([]string{`dnf`, `-y`, `--skip-broken`, `install`, `@multimedia`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `groupupdate`, `multimedia`, `--setop=install_weak_deps=False`, `--exclude=PackageKit-gstreamer-plugin`, `--skip-broken`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `groupupdate`, `sound-and-video`}, "", nil, true)
		bash.Run([]string{`dnf`, `-y`, `--allowerasing`, `install`, `ffmpeg`}, "", nil, true)
		core.progressBar.Step()

		installPKG(`libwebp`, `libwebp-devel`)
		installPKG(`webp-pixbuf-loader`)
		core.progressBar.Step()
	} else if PM == "apt" {
		//* install flatpak
		core.progressBar.Msg("Installing flatpak")
		installPKG(`flatpak`)
		bash.Run([]string{`flatpak`, `remote-add`, `--if-not-exists`, `flathub`, `https://flathub.org/repo/flathub.flatpakrepo`}, "", nil, true)
		// bash.Run([]string{`flatpak`, `update`, `-y`, `--noninteractive`}, "", nil, true)
		bash.Run([]string{`flatpak`, `install`, `-y`, `flathub`, `com.github.tchx84.Flatseal`}, "", nil, true)
		core.progressBar.Step()

		//* install snap
		core.progressBar.Msg("Installing snap")
		installPKG(`snap`)
		bash.Run([]string{`ln`, `-s`, `/var/lib/snapd/snap /snap`}, "", nil, true)
		bash.Run([]string{`systemctl`, `enable`, `snapd`, `--now`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`}, "", nil, true) // fix: not seeded yet will trigger and fix itself for the next command
		bash.Run([]string{`snap`, `install`, `core`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`, `core`}, "", nil, true)
		bash.Run([]string{`snap`, `refresh`}, "", nil, true)
		core.progressBar.Step()

		bash.Run([]string{`apt`, `-y`, `clean`}, "", nil, true)
		bash.Run([]string{`apt`, `-y`, `autoremove`}, "", nil, true)
		bash.Run([]string{`apt`, `-y`, `update`}, "", nil, true)
		if hasNalaPM {
			bash.Run([]string{`nala`, `update`}, "", nil, true)
		}
		core.progressBar.Step()

		//* install ubuntu extras
		core.progressBar.Msg("Installing Ubuntu Extras")
		// installPKG(`ubuntu-restricted-extras`)
		bash.Run(append([]string{`apt`, `-y`, `install`}, "ubuntu-restricted-extras"), "", []string{`DEBIAN_FRONTEND=noninteractive`}, true)
		core.progressBar.Step()
	}

	//* disable startups
	core.progressBar.Msg("Disabling Time Wasting Programs")
	if !SSHClient {
		bash.Run([]string{`systemctl`, `disable`, `NetworkManager-wait-online.service`}, "", nil, true)
	}
	bash.Run([]string{`systemctl`, `disable`, `accounts-daemon.service`}, "", nil, true) // is a potential securite risk
	bash.Run([]string{`systemctl`, `disable`, `debug-shell.service`}, "", nil, true)     // opens a giant security hole
	removePKG(`dmraid`)
	if PM == "dnf" {
		removePKG(`device-mapper-multipath`)
	}
	core.progressBar.Step()

	//* install programming languages
	core.progressBar.Msg("Installing programming languages")

	//* install python
	core.progressBar.Msg("Installing Python")
	if PM == "apt" {
		installPKG(`python3`, `python3-pip`)
	} else {
		installPKG(`python`, `python3`, `python-pip`, `python3-pip`)
	}
	core.progressBar.Step()

	//* install c
	core.progressBar.Msg("Installing C")
	if PM == "apt" {
		installPKG(`g++`, `make`, `gcc`)
	} else {
		installPKG(`gcc-c++`, `make`, `gcc`)
	}
	core.progressBar.Step()

	//* install java
	core.progressBar.Msg("Making Java")
	if PM == "apt" {
		// installPKG(`openjdk-8-jre`, `openjdk-8-jdk`, `openjdk-11-jre`, `openjdk-11-jdk`)
		installPKG(`openjdk-8-jre`, `openjdk-8-jdk`, `openjdk-25-jre`, `openjdk-25-jdk`)
	} else {
		// installPKG(`java-1.8.0-openjdk`, `java-11-openjdk`, `java-latest-openjdk`)
		installPKG(`java-1.8.0-openjdk`, `java-25-openjdk`, `java-latest-openjdk`)
	}
	core.progressBar.Step()

	//* install git and node
	core.progressBar.Msg("Installing Git and Node")
	if PM == "dnf" {
		installPKG(`git`, `nodejs`, `npm`)
	} else if PM == "apt" {
		installPKG(`git`, `nodejs`)
		if hasNalaPM {
			bash.Run([]string{`nala`, `install`, `-y`, `--no-install-recommends`, `npm`}, "", nil, true)
		} else {
			bash.Run([]string{`apt`, `-y`, `--no-install-recommends`, `install`, `npm`}, "", nil, true)
		}
	}
	core.progressBar.Step()

	//* install golang
	core.progressBar.Msg("Installing Go")
	if PM == "dnf" {
		installPKG(`golang`, `pcre-devel`)
	} else if PM == "apt" {
		installPKG(`golang`, `libpcre3-dev`)
	}
	core.progressBar.Step()

	//* docker
	core.progressBar.Msg("Installing Docker")
	if PM == "dnf" {
		installPKG(`dnf-plugins-core`)
		bash.Run([]string{`dnf`, `config-manager`, `--add-repo`, `https://download.docker.com/linux/fedora/docker-ce.repo`}, "", nil, true)
		installPKG(`docker-ce`, `docker-ce-cli`, `containerd.io`, `docker-buildx-plugin`, `docker-compose-plugin`)
		installPKG(`docker`)
		bash.Run([]string{`systemctl`, `enable`, `docker`, `--now`}, "", nil, true)
	} else if PM == "apt" {
		installPKG(`ca-certificates`, `curl`)
		bash.Run([]string{`install`, `-m`, `0755`, `-d`, `/etc/apt/keyrings`}, "", nil, true)
		bash.Run([]string{`curl`, `-fsSL`, `https://download.docker.com/linux/ubuntu/gpg`, `-o`, `/etc/apt/keyrings/docker.asc`}, "", nil, true)
		bash.Run([]string{`chmod`, `a+r`, `/etc/apt/keyrings/docker.asc`}, "", nil, true)
		bash.Run([]string{`echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null`}, "", nil, true)
		bash.Run([]string{`apt`, `-y`, `update`}, "", nil, true)
		if hasNalaPM {
			bash.Run([]string{`nala`, `update`}, "", nil, true)
		}
		installPKG(`docker-ce`, `docker-ce-cli`, `containerd.io`, `docker-buildx-plugin`, `docker-compose-plugin`)
		bash.Run([]string{`systemctl`, `enable`, `docker`, `--now`}, "", nil, true)
	}
	core.progressBar.Step()

	//* install security tools
	core.progressBar.Msg("Installing Security Tools")

	//* install fail2ban
	core.progressBar.Msg("Installing Fail2Ban")
	installPKG(`fail2ban`)
	bash.RunRaw(`if ! [ -f "/etc/fail2ban/jail.local" ]; then touch "/etc/fail2ban/jail.local"; echo '[DEFAULT]' | tee -a "/etc/fail2ban/jail.local"; echo 'ignoreip = 127.0.0.1/8 ::1' | tee -a "/etc/fail2ban/jail.local"; echo 'bantime = 3600' | tee -a "/etc/fail2ban/jail.local"; echo 'findtime = 600' | tee -a "/etc/fail2ban/jail.local"; echo 'maxretry = 5' | tee -a "/etc/fail2ban/jail.local"; echo '' | tee -a "/etc/fail2ban/jail.local"; echo '[sshd]' | tee -a "/etc/fail2ban/jail.local"; echo 'enabled = true' | tee -a "/etc/fail2ban/jail.local"; fi`, "", nil)
	bash.Run([]string{`systemctl`, `enable`, `--now`, `fail2ban`}, "", nil, true)
	core.progressBar.Step()

	//* install clamav
	core.progressBar.Msg("Installing Clamav")
	if PM == "dnf" {
		installPKG(`clamav`, `clamd`, `clamav-update`, `cronie`)
	} else if PM == "apt" {
		installPKG(`clamav`, `clamav-daemon`, `clamav-update`, `cronie`)
	}
	bash.Run([]string{`systemctl`, `stop`, `clamav-freshclam`}, "", nil, true)
	bash.Run([]string{`freshclam`}, "", nil, true)
	bash.Run([]string{`systemctl`, `enable`, `--now`, `clamav-freshclam`}, "", nil, true)
	bash.Run([]string{`freshclam`}, "", nil, true)
	core.progressBar.Step()

	//* fix clamav permissions
	os.MkdirAll("/VirusScan/quarantine", 0664)
	bash.RunRaw(`if grep -R "^ScanOnAccess " "/etc/clamd.d/scan.conf"; then sed -r -i 's/^ScanOnAccess (.*)$/ScanOnAccess yes/m' /etc/clamd.d/scan.conf; else echo 'ScanOnAccess yes' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.RunRaw(`if grep -R "^OnAccessMountPath " "/etc/clamd.d/scan.conf"; then sed -r -i 's#^OnAccessMountPath (.*)$#OnAccessMountPath /#m' /etc/clamd.d/scan.conf; else echo 'OnAccessMountPath /' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.RunRaw(`if grep -R "^OnAccessPrevention " "/etc/clamd.d/scan.conf"; then sed -r -i 's/^OnAccessPrevention (.*)$/OnAccessPrevention no/m' /etc/clamd.d/scan.conf; else echo 'OnAccessPrevention no' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.RunRaw(`if grep -R "^OnAccessExtraScanning " "/etc/clamd.d/scan.conf"; then sed -r -i 's/^OnAccessExtraScanning (.*)$/OnAccessExtraScanning yes/m' /etc/clamd.d/scan.conf; else echo 'OnAccessExtraScanning yes' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.RunRaw(`if grep -R "^OnAccessExcludeUID " "/etc/clamd.d/scan.conf"; then sed -r -i 's/^OnAccessExcludeUID (.*)$/OnAccessExcludeUID 0/m' /etc/clamd.d/scan.conf; else echo 'OnAccessExcludeUID 0' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.RunRaw(`if grep -R "^User " "/etc/clamd.d/scan.conf"; then sed -r -i 's/^User (.*)$/User root/m' /etc/clamd.d/scan.conf; else echo 'User root' | tee -a /etc/clamd.d/scan.conf; fi`, "", nil)
	bash.Run([]string{`freshclam`}, "", nil, true)
	core.progressBar.Step()

	//* install other security tools
	core.progressBar.Msg("Installing Security Tools")
	if PM == "dnf" {
		installPKG(`rkhunter`, `bleachbit`, `pwgen`, `dnf-automatic`, `selinux-policy-devel`)

		bash.RunRaw(`sed -r -i 's/^apply_updates(\s*)=(\s*)(.*)$/apply_updates\1=\2yes/m' "/etc/dnf/automatic.conf"`, "", nil, true)
		bash.Run([]string{`systemctl`, `enable`, `--now`, `dnf-automatic.timer`}, "", nil, true)
	} else if PM == "apt" {
		installPKG(`bleachbit`, `pwgen`, `unattended-upgrades`, `debconf-utils`, `apparmor-utils`)

		bash.Run(append([]string{`apt`, `-y`, `install`}, "rkhunter"), "", []string{`DEBIAN_FRONTEND=noninteractive`}, true)

		bash.RunRaw(`echo "unattended-upgrades unattended-upgrades/enable_auto_updates boolean true" | sudo debconf-set-selections`, "", []string{`DEBIAN_FRONTEND=noninteractive`}, true)
		bash.Run([]string{`dpkg-reconfigure`, `--frontend=noninteractive`, `unattended-upgrades`}, "", []string{`DEBIAN_FRONTEND=noninteractive`}, true)
	}
	core.progressBar.Step()

	core.progressBar.Msg("Initializing RKhunter")
	bash.Run([]string{`rkhunter`, `--update`}, "", nil, true)
	bash.Run([]string{`rkhunter`, `--propupd`}, "", nil, true)

	//* schedule scans
	bash.RunRaw(`if ! [[ $(crontab -l) == *"# clamav-scan"* ]] ; then crontab -l | { cat; echo '0 2 * * * nice -n 15 clamscan && clamscan -r --bell --move="/VirusScan/quarantine" --exclude-dir="/VirusScan/quarantine" --exclude-dir="/home/$USER/.clamtk/viruses" --exclude-dir="smb4k" --exclude-dir="/run/user/$USER/gvfs" --exclude-dir="/home/$USER/.gvfs" --exclude-dir=".thunderbird" --exclude-dir=".mozilla-thunderbird" --exclude-dir=".evolution" --exclude-dir="Mail" --exclude-dir="kmail" --exclude-dir="^/sys" / # clamav-scan'; } | crontab -; fi`, "", nil, true)
	core.progressBar.Step()

	//todo: add scheduled scans to virus scanning app
	// also make new virus scanning app that uses clamav

	//* install common apps
	core.progressBar.Msg("Installing Common Packages")

	if PM == "dnf" {
		installPKG(`nano`, `micro`, `neofetch`, `tmux`, `qemu-guest-agent`, `tuned`, `btrfs-progs`, `lvm2`, `xfsprogs`, `ntfs-3g`, `ntfsprogs`, `exfatprogs`, `udftools`, `p7zip`, `p7zip-plugins`, `hplip`, `hplip-gui`, `inotify-tools`, `guvcview`)
		bash.Run([]string{`systemctl`, `enable`, `sshd.socket`, `--now`}, "", nil, true)
	} else if PM == "apt" {
		installPKG(`nano`, `micro`, `neofetch`, `tmux`, `qemu-guest-agent`, `tuned`, `btrfs-progs`, `lvm2`, `xfsprogs`, `ntfs-3g`, `ntfs-3g`, `exfatprogs`, `udftools`, `p7zip`, `hplip`, `hplip-gui`, `inotify-tools`, `guvcview`)
	}
	bash.Run([]string{`systemctl`, `enable`, `fstrim.timer`, `--now`}, "", nil, true)
	bash.Run([]string{`systemctl`, `enable`, `systemd-oomd.service`, `--now`}, "", nil, true)
	core.progressBar.Step()

	//* install fonts
	if PM == "dnf" {
		installPKG(`jetbrains-mono-fonts`)
		core.progressBar.Step()
	}

	//* update
	core.progressBar.Msg("Updating")
	update(true)
	core.progressBar.Step()
}

func (core *coreInstaller) files() {
	filePerms := map[string]os.FileMode{}

	if buf, err := os.ReadFile("assets/fs/.perms.json"); err == nil {
		if json, err := goutil.JSON.Parse(buf); err == nil {
			for key, val := range json {
				switch v := val.(type) {
				case string:
					if perm, err := strconv.ParseUint(v, 8, 32); err == nil {
						filePerms[key] = os.FileMode(perm)
					}
				case float64:
					filePerms[key] = os.FileMode(uint32(v))
				}
			}
		}
	}

	core.installFiles(&filePerms, "", 0755)
}

func (core *coreInstaller) countFiles(dir string) {
	if files, err := assetFS.ReadDir("assets/fs" + dir); err == nil {
		for _, file := range files {
			path := dir + "/" + file.Name()
			if strings.HasPrefix(path, "/.") {
				continue
			}

			if file.IsDir() {
				core.countFiles(path)
				continue
			}

			core.progressBar.AddSize(1)
		}
	}
}

func (core *coreInstaller) installFiles(filePerms *map[string]os.FileMode, dir string, dirPerm os.FileMode) {
	if files, err := assetFS.ReadDir("assets/fs" + dir); err == nil {
		for _, file := range files {
			path := dir + "/" + file.Name()
			if strings.HasPrefix(path, "/.") {
				continue
			}

			// skip package manager specific files
			if goutil.Contains(supportedPM, file.Name()) && PM != file.Name() {
				continue
			}

			if file.IsDir() {
				if dir, err := os.Stat(path); err == nil {
					dirPerm = dir.Mode().Perm()
				}

				core.installFiles(filePerms, path, dirPerm)
				continue
			}

			if buf, err := assetFS.ReadFile("assets/fs" + path); err == nil {
				var perm os.FileMode = 0644
				if val, ok := (*filePerms)[path]; ok {
					perm = val
				}

				os.MkdirAll(dir, dirPerm)
				os.WriteFile(path, buf, perm)

				core.progressBar.Step()
			}
		}
	}
}